CVE-2025-66378 Missing authorization in Infinity
An attacker can disconnect RTMP streams traversing a Proxy Node due to insufficient access control in Pexip Infinity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66378?
CVE-2025-66378 is a medium-severity missing authorization vulnerability in Pexip Pexip Infinity, published on 25 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMP streams traversing a Proxy Node.
Weakness: CWE-863
Which versions are affected by CVE-2025-66378?
It affects 1 product.
Products include Pexip Pexip Infinity.
How do I fix CVE-2025-66378?
No fix has been published for CVE-2025-66378 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-66378 being exploited?
There is no known exploitation of CVE-2025-66378 in the wild and no public exploit code.
Other vulnerabilities in Pexip Pexip Infinity
Sources
Also known as GHSA-34j4-424f-xr64.